EEF-CVE-2026-66293

Dashboard / Vulnerabilities / EEF-CVE-2026-66293

EEF-CVE-2026-66293

Summary: XML comment injection in Saxy encoder via unescaped double hyphen

Details: ## Summary XML injection in the encoder of Saxy. `Saxy.Encoder` does not neutralize the `--` sequence in XML comment content: `escape_comment/2` returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single `-`, so neither an interior `--` nor a full `-->` is escaped or rejected before the encoder wraps the content in the `<!--` and `-->` delimiters. When an application serializes attacker-controlled text as a comment, through `Saxy.XML.comment/1` or a raw `{:comment, text}` simple form child, the attacker can close the comment early with `-->` and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector. This issue affects saxy: from 0.7.0 before 1.7.0. ## Workarounds Reject or rewrite the `--` sequence in untrusted text before passing it to `Saxy.XML.comment/1`, for example by replacing `--` with `- -`. Alternatively, stop emitting untrusted data as XML comments. Comments carry no semantic payload for consumers, so the text can usually be moved into an element or a CDATA section instead. ## Configurations Only applications that place untrusted text into an XML comment node are affected. The untrusted value must reach `Saxy.XML.comment/1` or a raw `{:comment, text}` simple form child that is then serialized with `Saxy.encode!/2` or `Saxy.encode_to_iodata!/2`. Documents that are only parsed by Saxy never reach the encoder and are not a vector.

References: https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698, https://cna.erlef.org/cves/CVE-2026-66293.html, https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690, https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41, https://hex.pm/packages/saxy